Safeguarding your data

At Google, we are keenly aware of the trust you place in us and our responsibility to keep your privacy and data secure. As part of this responsibility, we let you know what information we collect when you use our products and services, why we collect it, and how we use it to improve your experience. The Google privacy policy & principles describes how we treat personal information when you use Google's products and services, including Google Analytics.

Google Analytics protects the confidentiality of Google Analytics data in several ways:

The Google Analytics terms of service, which all Google Analytics customers must adhere to, prohibit sending personally identifiable information (PII) to Google Analytics. PII includes any data that can be used by Google to reasonably identify an individual, including (but not limited to) names, email addresses, or billing information.

Google Analytics data may not be shared without customer consent, except under certain limited circumstances, such as when required by law.

Security-dedicated engineering teams at Google guard against external threats to data. Internal access to data (e.g., by employees) is regulated and subject to the Employee Access Controls and Procedures.

Google provides the following controls to website owners who have implemented Google Analytics and to website users to provide more choice on how their data is collected by Google Analytics.

Google Analytics opt-out browser add-on Website users that don’t want their data reported by the Google Analytics JavaScript can install the Google Analytics opt-out browser add-on. This add-on instructs the Google Analytics JavaScript (ga.js, analytics.js, and dc.js) to prohibit sending information to Google Analytics. The browser add-on is available for most modern browsers. The Google Analytics opt-out browser add-on does not prevent information from being sent to the website itself or to other web analytics services. Learn more about the Google Analytics opt-out browser add-on.

Disable Google Analytics and implement independent opt-out controls Website owners using the Google Analytics JavaScript (ga.js, analytics.js, and dc.js) can disable tracking on a page without having to remove the Google Analytics JavaScript snippet. Site owners that use this method can also build their own notifications and controls for site users, or implement privacy controls built by third-party developers. Learn more about how site owners can disable tracking.

Google Analytics SDK and Measurement Protocol notice and opt-out The owners of any site, app, or other digital device or service that implements any alternative collection method and/or feature via the Google Analytics SDK or the Measurement Protocol are required by our policies to provide notice and offer a choice (such as an opt-out) to users.

Google Account settings As of June 28, 2016, Google users have the option to review settings that give them more control over data collected about web and app activity on Google partner sites. At this time, these settings have no effect on Google Analytics product capabilities, terms of service, privacy policy, data security, or data sharing policies. Learn more.

Google Analytics mainly uses first-party cookies to report on user interactions on Google Analytics customers’ websites. These cookies are used to store non-personally identifiable information. Browsers do not share first-party cookies across domains.

For customers who use Google Analytics Advertising Features, Google advertising cookies are used to enable features, such as Remarketing, for products like AdWords on the Google Display Network. For more information about how Google uses advertising cookies, visit the Google Advertising Privacy FAQ. To manage settings for these cookies and opt-out of these features, visit the Ads Settings.

Google Analytics customers who have enabled the analytics.js collection method via Universal Analytics can control whether or not they use cookies to store an anonymous or random client identifier. If the customer decides to set a cookie, the information stored in the local first-party cookie is reduced to a random identifier (e.g., 12345.67890).

Universal Analytics introduces more feature-configuration options and new collection methods, including via the Measurement Protocol. Although these features don’t change the Google Analytics security and privacy principles very much, any site, app, or other digital device or service that implements certain features of Universal Analytics (like the Measurement Protocol) is responsible for providing notice and offering control to their users.

In case Google Analytics customers use a service that has implemented Universal Analytics, check the notice given and choice offered by this service directly with the Google Analytics customer using such service, as the opt-out directly provided by Google Analytics does not affect data reported through certain features of Universal Analytics, such as the Measurement Protocol. For more information, review the Universal Analytics usage guidelines and the Universal Analytics security and privacy information.

Every computer and device connected to the Internet is assigned an Internet Protocol (IP) address. IP address are usually assigned in country-based blocks and can often be used to identify the country, state, and city from which a computer is connecting to the Internet. Because IP addresses need to be used by websites in order for the Internet to function, website owners have access to the IP addresses of their users regardless of whether or not they use Google Analytics. Google Analytics uses IP addresses to provide and protect the security of the service, and to give website owners a sense of where in the world their users come from (also known as "IP geolocation").

A method known as IP masking gives website owners using Google Analytics the option to tell Google Analytics to use only a portion of an IP address, rather than the entire address, for geolocation.

The Google Analytics data-sharing settings let Google Analytics customers share their account data with other products and services. Sharing data provides feedback about Google Analytics we can use to build better features and education material. There are several types of data-sharing settings that can be changed at any time. If no options are selected, Google Analytics account data will be excluded from any automated processes that aren't specifically related to operating Google Analytics or to protecting the security and integrity of the data. Learn more about the Google Analytics data-sharing settings.

Account users can export reports at any time from Google Analytics using the XML, PDF or CSV download options, or via the Google Analytics Core Reporting API. The exported data can be used independently without Google Analytics or with other applications/services in conjunction with Google Analytics.

Account users can also delete a view within their Google Analytics account at any time.

Access to customer-level account data may be granted on a strict need-only basis to employees who require the specific access to perform their jobs. Employees requesting access must explain why they need the access, demonstrate familiarity with the access policy and agree to its terms and conditions, and receive approval before they can access the data.

Customer Service Representatives and support personnel may not access customer-level data without explicit permission from the customer.

When accessing customer data, employees will restrict activity to those reports they need to complete their official duties.

Employees may not access data using any network-enabled device not owned or approved by Google.

Data is stored in an encoded format optimized for performance, rather than stored in a traditional file system or database manner. Data is dispersed across a number of physical and logical volumes for redundancy and expedient access, thereby obfuscating it from tampering.

Google applications run in a multi-tenant, distributed environment. Rather than segregating each customer's data onto a single machine or set of machines, data from all Google customers (consumers, business, and even Google's own data) is distributed among a shared infrastructure composed of Google's many homogeneous machines and located in Google's data centers.

To minimize service interruption due to hardware failure, natural disaster, or other catastrophe, Google implements a comprehensive disaster-recovery program at all of its data centers. This program includes multiple components to eliminate single points of failure, including the following:

Data replication To help ensure availability in the event of a disaster, Google Analytics data stored in Google's distributed file system is replicated to separate systems in different data centers.

Geographical distribution of data centers Google operates a geographically distributed set of data centers that is designed to maintain service continuity in the event of a disaster or other incident in a single region. High-speed connections between the data centers help ensure swift failover. Management of the data centers is also distributed to provide location-independent, around-the-clock coverage, and system administration.

Resilient and redundant infrastructure Google's computing clusters are designed with resiliency and redundancy in mind, helping minimize single points of failure and the impact of common equipment failures and environmental risks. Dual circuits, switches, networks, and other necessary devices are utilized to provide redundancy. Facilities infrastructure at the data centers has been designed to be robust, fault tolerant, and concurrently maintainable.

Continuity plan in the event of disaster In addition to the redundancy of data and regionally disparate data centers, Google also has a business-continuity plan for its headquarters in Mountain View, CA. This plan accounts for major disasters, such as a seismic event or a public-health crisis, and it assumes people and services may be unavailable for up to 30 days. This plan is designed to enable continued operations of our services for our customers.